# BadHost, Dead CTFs, Exploding NPMs, and the Verizon DBIR - ASW #385

Page: https://stenobird.com/podcast/security-weekly-podcast-network-video-841420/badhost-dead-ctfs-exploding-npms-and-the-verizon-dbir-asw-385
Text version: https://stenobird.com/podcast/security-weekly-podcast-network-video-841420/badhost-dead-ctfs-exploding-npms-and-the-verizon-dbir-asw-385.md
Podcast: [Security Weekly Podcast Network (Video)](https://stenobird.com/podcast/security-weekly-podcast-network-video-841420)
Published: 2026-06-02T09:00:00+00:00
Episode link: https://securityweeklytv.libsyn.com/badhost-dead-ctfs-exploding-npms-and-the-verizon-dbir-asw-385
Audio file: https://dts.podtrac.com/redirect.mp3/traffic.libsyn.com/secure/securityweeklytv/ASW_385_1--712b8b4e-9c6b-4baf-bb8c-4ac589cd0726--sd-converted--177197c3-7202-4c92-8a12-27dae702523a.mp4?dest-id=292819
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/security-weekly-podcast-network-video-841420/episodes/badhost-dead-ctfs-exploding-npms-and-the-verizon-dbir-asw-385
Duration seconds: 2722

## Resource

We dedicate an episode to catching up on appsec news with Kalyani Pawar. We see parsing problems that led to the BadHost vuln, which exposed lots of LLMs, MCPs, and agents to potential compromise. We wonder where to look for security education and practice as the camaraderie of the CTF community becomes infiltrated by LLMs. We talk about the tradeoffs in trust between using public packages vs. having agents write replacements from scratch. And we examine some of the appsec details that the Verizon DBIR reveals about how orgs are being attacked -- and how orgs might use that information to protect themselves. Show Notes: https://securityweekly.com/asw-385

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/security-weekly-podcast-network-video-841420/episodes/badhost-dead-ctfs-exploding-npms-and-the-verizon-dbir-asw-385/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/security-weekly-podcast-network-video-841420/badhost-dead-ctfs-exploding-npms-and-the-verizon-dbir-asw-385.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.